On Thu, May 13, 2010 at 3:45 PM, Markus Feldmann <feldmann_markus@xxxxxx> wrote: > Thanks for your answer, > > i have an ESTABLISHED rule, look at line 127 Having a rule doesn't mean that it's doing what you want it to. =) Since you have DROP policies, having EST/REL packets return to the originating INPUT/FORWARD chain just drops them if nothing else matches. Instead, try ACCEPT, as in: iptables -A attacksinput -m state --state ESTABLISHED,RELATED -j ACCEPT Can I get confirmation from Jan or someone else that a preferred and more future-proof syntax is the following? iptables -A attacksinput -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT --Mike -- To unsubscribe from this list: send the line "unsubscribe netfilter" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
